How to Interpret Logged Data

Monitoring Your Network - Monitoring Alarms - Reading Logged Data - How to Interpret Logged Data -
Reading Logged Data Resetting Alarms

How to Interpret Logged Data

Once you've determined where the data you're interested in is being logged, you need to know how to interpret that data. Log File Entry shows a sample entry from a log file.

Log File Entry

Fields in a Log Entry explains what information the fields in this report contain.

Fields in a Log Entry

Field	Contains
Time	Date and time the record was logged. The format of the time is mm/dd/yyyy hh:mm:ss day (for example, 10/29/1997 14:32:22 Sat).
LogID	Identification number of the log entry. NerveCenter assigns a sequential number to each log entry.
DestStateSev	Severity of the transition's destination state.
NodeProperty	Property group of the node that caused the alarm to change states.
NodeName	Name of the node that caused the alarm to change states.
AlarmName	Name of the alarm.
OrigState	Name of the state from which the alarm moves when the logged transition occurs.
TriggerName	Name of the trigger that causes the alarm to move from the Ostate to the Nstate.
DestState	State of the alarm after the logged transition occurs.
TrapPduTime	The contents of a trap's timestamp field. Used only when the transition is caused by a trap-mask trigger.
TrapPduGeneric	The contents of a trap's generic-trap field. Used only when the transition is caused by a trap-mask trigger.
TrapPduEnterprise	The contents of a trap's enterprise field. Used only when the transition is caused by a trap-mask trigger.
TrapPduSpecific	The contents of a trap's specific-trap field. Used only when the transition is caused by a trap-mask trigger.
TriggerInstance	The specific base object instance for which the transition occurred.
TriggerBaseObject	The base object associated with the transition.
Attribute ...	The variable bindings of the trigger that caused the transition. Each variable binding is printed in the format `Attribute` attribute.instance`=`value.

When you're processing a log file created by a particular alarm, keep in mind the following rules:

If the alarm has Enterprise scope, all the entries in the log constitute a single data set.
If the alarm has Node scope, all entries that refer to the same node make up a data set.
If the alarm has Subobject scope, the entries that share a node and subobject constitute a data set.
If the alarm has Instance scope, the entries that share an instance of an alarm, regardless of the MIB objects listed, constitute a data set.
A log that is the result of a poll transition contains only data pertinent to a poll. For example, TriggerBaseObject will contain a value, but TrapPduTime will not.
A log that is the result of a trap mask transition contains only data pertinent to a trap. For example, TrapPduTime will contain a value, but TriggerBaseObject will not.

Reading Logged Data	Resetting Alarms
	29 July 2003